Server is sending spam

Hello,
I'm here again because I have a complicated problem which is that the zimbra server is sending spam despite still not being used by users, and I have already been blacklisted, plus the service is being consumed zimbra all the RAM.
How I can fix this?
This is the zimbra MTA log:

Mail server emitting "Digital Photo/Video Editing" spam and other spam, very probably an open relay.

mail.mydomain.com. 4H IN A my.IP.public.static

*SPAM EVIDENCE IS IN THE MAIL LOG FILE OF THE SERVER* (and possibly in the mail queue). Spam messages can be located by looking for the following forged sender(s) (but not necessarily the only ones):letelaioa54igaso@msn.com

Note that removing virus/malware, even if generally helpful, is *NOT* the way to solve this problem. This is an open relay problem.

I appreciate any help.

Note: The email account listed in the log of mailbox does not exist, or at least we have not created us. example lzcjyuucz@mydomain.com and / or spam.regjsfrgja @ mydomain.com

Note that removing virus/malware, even if generally helpful, is *NOT* the way to solve this problem. This is an open relay problem.

That's not likely as ZCS is not an open relay by default unless you've configured it as such.

Have you checked to see which 'account(s)' on your server are sending the mail (check the log files)? Have you also checked the forum thread on 'Compromised Account'? Have you also set-up more secure password requirements in the Admin UI/COS? For starters, take a look at some of these threads: site:zimbra.com +passwords +account +compromised - Yahoo! Search Results

That's not likely as ZCS is not an open relay by default unless you've configured it as such.

Have you checked to see which 'account(s)' on your server are sending the mail (check the log files)? Have you also checked the forum thread on 'Compromised Account'? Have you also set-up more secure password requirements in the Admin UI/COS? For starters, take a look at some of these threads: site:zimbra.com +passwords +account +compromised - Yahoo! Search Results

Hi phoenix thanks for taking my problem,
I am reviewing what I have suggested uqe but while I do that I would like you to help me understand the logs that you post on the first post, because according to what I have seen these could be the key. For example, the log from / var / log / zimbra.log, that shows me is that normal? and that means the line [MailboxPurge] [name = spam.regjsfrgja @ mydomain.com; mid = 3;] purge - Purging log messages Mailbox.log.
It would be very helpful for me to coax me with this information.
From already thank you very much for your time!

Ok thanks, I'll keep working on it and any developments will be here with you.

Hello!
I have been reviewing different post about my problem and I found two things that seem common.
The first is that by default the zimbra does not act as open relay, and the second is that two people who have the same problem happened to me, zimbra works as open relay, they have the ip of the MTA in a DMZ.
So I set out clearly the structure of my system to get me to understand:

ZIMBRA ------------ SWITCH----------ROUTER DMZ---------INTERNET

The router is set up a DMZ to the zimbra, using one of two Internet connections.
In the zimbra server is set up a local dns server to resolve this public ip as the server on the network interface using a local ip in the router is masked with the public.
This was working perfectly, until we came upon some spam blacklists.
Then notice that the server was very slow and would not let me connect with him, to review the processes I realized that the process of zimbra I was consuming 70% of the RAM.
I decided to turn the issue zimbra to stop spam and that the server will work normally while I find the solution, I have also deleted accounts were only 4.
Again the question is how do I stop zimbra be used as open relay?
A that was due to zimbra you were consuming too much RAM?
Here is some logs to support what I am saying:
/var/log/zimbra.log

And check mx toolbox, they would suggest this:
Mail server emitting "Digital Photo/Video Editing" spam and other spam, very probably an open relay.

mail.ejimenez.com.co. 4H IN A myip-public-static

*SPAM EVIDENCE IS IN THE MAIL LOG FILE OF THE SERVER* (and possibly in the mail queue). Spam messages can be located by looking for the following forged sender(s) (but not necessarily the only ones):letelaioa54igaso@msn.com

Note that removing virus/malware, even if generally helpful, is *NOT* the way to solve this problem. This is an open relay problem.
from now Thanks for your help.